Tomorrow is the Update Stack: local to SYSTEM, already used, due September 22

Today is the Linux kernel. Tomorrow is Windows. CVE-2026-81963 sits in the Update Stack, the code that installs the patches you think you already applied. Microsoft called it exploited when the September 8 bulletin shipped. CISA put it on KEV the same day. Federal civilian shops have until September 22. We buried it in the Patch Tuesday pile two weeks ago. Monday is the day to pull it back out, because a local-to-SYSTEM bug in the updater is how last month's foothold becomes this month's domain admin while you are busy rebooting Linux.

What it is

Improper link resolution (CWE-59) plus a weak access check. A user who is already on the box, no extra click, can climb to SYSTEM if the Stack follows a link it should not. That is not remote code execution from the internet. It is the second stage after phishing, after a malicious installer, after a shared workstation. Microsoft's exploitability line on publication was "Exploitation Detected." Tenable noted it was the first Update Stack elevation since 2022 to show up as a live zero-day. The September pair was this one and ALPC CVE-2026-85880, also used, also local to SYSTEM. If you only shipped one of them, you shipped half a Tuesday.

Affected builds include Windows 11 23H2 through 26H1 and Windows Server 2025, in the ranges Microsoft listed against KB5122880, KB5124008, KB5124012, and KB5122871. Confirm the build, not the WSUS approval. A laptop that "got September" and then sat in a bag is not evidence.

Why this is a Monday problem in Alberta

Kernel hosts get the attention today because CISA set a three-day clock. Workstations get skipped because "it is only local." Rapuncel last week was a signed driver that killed EDR and then stole the vault. An Update Stack climb is how that kind of foothold finishes the job. You do not need a new campaign name. You need one PC that still has a user-level implant and an unpatched Stack.

BOD 26-04 also asks federal teams to look for compromise before they call the host done. Civilian shops skip that part. If a box was on the vulnerable Stack for two weeks after Microsoft said it was being used, a clean KB is necessary and it is not the whole job. Review odd service installs and local accounts that should not have been able to become SYSTEM. We will not walk the link. The operational fact is enough.

What we would check before Tuesday

• Windows 11 and Server 2025: the September cumulative that names CVE-2026-81963. winver after the reboot. The ticket is not evidence.
• If you split the two zero-days, ALPC CVE-2026-85880 rides in the same bulletin. Do not leave it for October.
• Linux KEV trio today if you have not rebooted. The four public local-root tests from Sunday ride in that window.
• ISE is already late. Cyber Centre AL26-021 still says patch and re-image if the node looks dirty.

Bottom line

The updater is part of the attack surface. Forensic Five reviews what is actually patched, including the Stack that was supposed to do the patching. From St. Albert, Alberta. Finish the kernel today. Finish Windows tomorrow.